UBUNTU-CVE-2026-68239

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

UBUNTU-CVE-2026-68260

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vmctx-lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is...

UBUNTU-CVE-2026-68303

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use devgetdrvdatamaster in their unbind functions. Since the vc4-drm gets removed before its dependent drivers vc4hvs/vc4v3d the vc4hvsunbind/vc4v3dunbind...

CVE-2026-68195

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7615rxcheck and mt7615queuerxskb dispatch it to mt7615mactxfree on every bus. mt7615mactxfree cleans the DMA tx queues with...

CVE-2026-68327

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

CVE-2026-68309

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: fix possible NULL-pointer deref in mt76connacmcuunibsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68157

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

CVE-2026-68193

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

UBUNTU-CVE-2026-68305

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

UBUNTU-CVE-2026-68197

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiextdlsaddhtoper gates its follow-the-AP-bandwidth path on bssdesc-bcnhtcap being present, but then dereferences a different pointer, bssdesc-bcnhtoper...

UBUNTU-CVE-2026-68345

In the Linux kernel, the following vulnerability has been resolved: armmpam: guard MBWU state before adding it to garbage destroycomponentcfg adds each RIS mbwustate object to the MPAM garbage list when destroying component configuration. However, mbwustate is allocated per RIS and only for RISes...

UBUNTU-CVE-2026-68275

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

UBUNTU-CVE-2026-68273

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Bot...

UBUNTU-CVE-2026-68261

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

UBUNTU-CVE-2026-68378

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpllmsgaddpinrefsync When a dpllpin is shared across multiple dplldevice instances and those devices are being unregistered e.g. during driver module removal, a NULL pointer dereference can...

UBUNTU-CVE-2026-68243

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...

UBUNTU-CVE-2026-68242

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix NULL deref on schedengine alloc failure Avoid using intelcontextput before intelcontextinit in execlistscreatevirtual as the krefput inside would lead to NULL deref on the IOCTL path when schedengine allocation...

UBUNTU-CVE-2026-68176

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix mmiotrace possible NULL dereferencing of hiter-dev If the mmiopipeopen fails to find a PCI device, the hiter-dev will be assigned to NULL. The mmiotrace read function dereferences the hiter-dev if hiter exists. Chang...

UBUNTU-CVE-2026-68418

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp-iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp-iwpbl is...

UBUNTU-CVE-2026-68310

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: guard HE capability lookups mt7915mcubsshetlv and mt7915mcustabfertlv both run after checking HE support, then dereference the HE PHY capability returned by mt76connacgethephycap. That helper can return NULL...